# Data and privacy

> What BigModel.io keeps from your API requests, for how long, and what model providers see. Prompts are not stored after delivery and never used for training.

Web version: https://bigmodel.io/docs/data-privacy · Updated 2026-10-18

This page summarizes how BigModel.io handles the data in your API requests. The [Privacy Policy](https://bigmodel.io/legal/privacy-policy) (effective 2026-10-17) is the binding text; if the two ever differ, the policy wins.

| Data | Kept by BigModel.io? |
|---|---|
| Prompts, files and outputs of **successful** requests | No. Forwarded to the model provider and not kept after the response is delivered. |
| Body of **failed** requests | Up to 30 days, for debugging, with credentials removed |
| Video and other async tasks | Task parameters, including the prompt, kept with the task; generated files kept for a limited time so you can download them |
| Usage records | Yes: API key, model, time, tokens, cost, status, latency, error type, request ID, endpoint, IP address and User-Agent. No prompt content. |
| App attribution | Daily aggregates of the `HTTP-Referer` host and `X-Title`. See [App attribution](https://bigmodel.io/docs/app-attribution). |

## What the gateway does with your prompts

- **No training.** BigModel.io does not use your prompts or outputs to train models.
- **No sale.** BigModel.io does not sell your personal information.
- **Success path.** A successful request passes through to the provider of the model you chose and the content is not stored once the response is returned.
- **Failure path.** If a request fails, its body may be kept for up to 30 days so the error can be investigated. API keys and other credentials are removed first.

## What model providers see

To answer a request, BigModel.io sends its content to the provider of the model you picked. Each provider processes it under its own terms and privacy policy. Some providers may keep request content for a while or use it to improve their services. Contact support before you send sensitive data, and do not send personal data, trade secrets or regulated data that you are not allowed to share.

## Reduce what you send

- Remove names, emails, phone numbers, keys and other secrets from prompts when the task does not need them.
- Use one API key per app or environment so usage records stay separable, and delete keys you no longer use.
- Do not call the API from browser code. Your key would be exposed, and the request carries the user's IP and User-Agent.
- Download video outputs you need before their retention deadline; see [Video generation](https://bigmodel.io/docs/video-generation).

## See what is recorded about your requests

The [Usage](https://bigmodel.io/usage) page shows every record kept for your account: key, model, endpoint, tokens, cost, timing and User-Agent. You can filter it and export it as CSV. For one key, `GET /v1/usage` returns the same counters:

```bash [cURL]
curl https://bigmodel.io/v1/usage \
  -H "Authorization: Bearer $BIGMODEL_API_KEY"
```

## Verify the setup

Send a request, then open [Usage](https://bigmodel.io/usage). The new row shows metadata (model, tokens, cost, User-Agent) and no prompt or output text. That row is all BigModel.io keeps from a successful request.

## Your rights and requests

You can ask to access, correct, export or delete your personal information, or object to some processing. Email support@bigmodel.io from your account address; the policy commits to an answer within 30 days. Some records, such as billing records, are kept as long as accounting, tax and dispute rules require.

## Troubleshooting

**You need a provider's own data terms.** BigModel.io cannot change how a provider handles content. Ask through [Support](https://bigmodel.io/support) before you send sensitive data.

**You sent something you should not have.** For a successful request, BigModel.io kept no content. For a failed request, the body may be kept for up to 30 days; contact support@bigmodel.io with the request ID (`X-Request-ID` response header).

**You need a security questionnaire or a DPA.** For security questionnaires or a DPA, contact support@bigmodel.io.

## Related

- [Privacy Policy](https://bigmodel.io/legal/privacy-policy) and [Terms of Service](https://bigmodel.io/legal/terms).
- [App attribution](https://bigmodel.io/docs/app-attribution) for what the attribution headers record.
- [Authentication](https://bigmodel.io/docs/authentication) for keeping keys safe.